Privacy Policy
Version 1.2 · Effective [date]
This policy explains what personal information [Company Legal Name] ("felyx-photos," "we") collects, why, who we share it with, and the choices you have. When you book with a photography studio on our platform, that studio is responsible for your information and we handle it on its behalf; the studio's own privacy notice on its booking site applies too.
What we collect
| Who | What we collect | Where it comes from |
|---|---|---|
| Studio owners and team members | Name, email, phone, business name, password (stored as a one-way hash), plan and billing status, Stripe account and customer references, settings | You, Stripe |
| Clients of studios | Name, email, phone, company or brokerage, property or event address, answers to booking questions, booking dates and choices, messages, photo favorites, payment history and saved-card references (not card numbers) | You, the studio, Stripe |
| People who sign agreements | Typed name, time of signing, IP address, browser details, the exact agreement text and its fingerprint | You and your browser |
| Photos and files | Photos, videos and documents uploaded by studios, which may show you or your family | The studio |
| Everyone | IP address and basic request information in security logs; clicks on studio short links counted by day and source (no profile is built) | Your browser |
We do not collect card numbers; Stripe does. We do not knowingly collect information directly from children under 13. Photos of children may be uploaded by a studio at a parent's request.
How we use it
- To run the Service: booking, scheduling, agreements, payments, photo delivery, messages and account access.
- To send service emails: confirmations, receipts, payment reminders, messages and security notices. We do not send marketing emails to studios' clients.
- To keep the Service secure: preventing fraud, spam and abuse, rate limiting, and investigating incidents.
- To bill studios and enforce our Terms.
- To meet legal obligations, such as tax and payment records.
We do not sell personal information, share it for cross-context behavioral advertising, or use studios' client data to train AI models.
Who we share it with
| Service provider | What they do | Data involved |
|---|---|---|
| Stripe, Inc. | Card payments, saved cards, payouts, studio subscriptions | Payment and billing details |
| Backblaze, Inc. | Storage of photos, files and archived agreements | Photos, files, agreements |
| [hosting provider] | Runs the application and database | All Service data |
| [email provider] | Delivers service emails | Name, email address, email content |
We also share information with the studio you book with; with authorities when the law requires it; and with a buyer if our business is sold, under this policy. Fonts and page assets are served from our own servers, so loading a page does not send your information to third-party font services.
The full list, with locations and what each one does, is on our subprocessors page.
Cookies
We use only cookies needed to run the Service: a session cookie that keeps you logged in and a security cookie that prevents cross-site request forgery. We do not use advertising or analytics cookies.
How long we keep it
- Signed agreements and their signature records: 7 years after signing, even if the studio's account is deleted, so either party can prove what was agreed.
- Card-on-file authorizations, payment and booking records: 7 years, for tax and dispute purposes.
- Camera originals: 45 days after delivery. Delivered photos and messages: while the studio's account is active.
- Inactive Free studio accounts: deleted after 90 days without activity, except archived agreements.
- Security logs: 90 days.
Security
We use encrypted connections (HTTPS) everywhere, store passwords as one-way hashes, keep storage keys encrypted, keep photo storage private with short-lived signed links, separate each studio's data, and limit staff access. No system is perfectly secure; we will notify affected people and authorities of a data breach as the law requires.
Your choices and rights
You can view and update your account details in your account settings. You can ask for a copy of your information, ask us to correct or delete it, or ask us to stop processing it, by emailing privacy@staging.felyxphotos.com. If you booked with a studio, we may pass your request to that studio, since it controls your booking records. We will respond within 45 days and will not treat you differently for exercising your rights. Some records, such as signed agreements and payment records, may be kept for the periods above. Depending on where you live (for example Texas, California or the European Union), you may have additional rights under local law, including the right to appeal a refusal by replying to our decision.
People in the EU, the UK and Switzerland
This section applies if the GDPR, the UK GDPR or the Swiss Data Protection Act applies to you.
Who is responsible. For studios' clients, the studio is the "controller" and [Company Legal Name] is its "processor" (see our Data Processing Addendum). For studio owners and team members, visitors to our own website and our security logs, [Company Legal Name] is the controller.
Why we may use your information (lawful bases).
- To carry out our contract with you or take steps you ask for before it (running your account, bookings, payments and delivery).
- Our legitimate interests in keeping the Service secure, preventing fraud and abuse, and improving it, which we balance against your rights.
- To comply with the law, such as tax and accounting records.
- Your consent, where we ask for it (for example saving a card for automatic payments). You can withdraw consent at any time.
Your rights. You may ask for access to your information, correction, deletion, restriction, a portable copy, and to object to processing based on legitimate interests. Clients can download their data and ask for deletion from their account page on the studio's booking site. Studio owners can download an export from the dashboard. You can also write to privacy@staging.felyxphotos.com. Some records must be kept for the periods above; when a client's deletion is carried out, personal details are removed from the booking records while payment and signed-agreement records are kept.
Complaints. You have the right to complain to your data protection authority, such as the Information Commissioner's Office (UK), the authority in your EU country of residence, work or where you think a breach happened, or the Swiss Federal Data Protection and Information Commissioner. We would like the chance to help first, so please contact us.
International transfers. [Company Legal Name] and some of our providers are in the United States. When your information goes outside the EEA, the UK or Switzerland, we rely on the EU Standard Contractual Clauses (and the UK International Data Transfer Addendum), or on an adequacy decision, such as the EU-US Data Privacy Framework where the provider is certified. Ask us at privacy@staging.felyxphotos.com for a copy of the safeguards.
Automated decisions. We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.
People in Australia, New Zealand, Singapore and Hong Kong
If you are in Australia, New Zealand, Singapore or Hong Kong, you may ask to see and correct personal information we hold about you under your local privacy law (the Australian Privacy Principles, the NZ Privacy Act 2020, the Singapore PDPA or the Hong Kong PDPO). Your information may be stored and processed in the United States and other countries where our providers operate; we take reasonable steps to make sure they protect it. If you are not satisfied with our response, you can complain to your national privacy regulator.
Contact
[Company Legal Name], [mailing address], privacy@staging.felyxphotos.com. We will post changes to this policy here and email studios about material changes.